{{- /*
Flux Kustomization watching the SME-tenant overlay tree (issue #882).

WHY THIS FILE EXISTS
--------------------
The catalyst-api SME-tenant pipeline's GitOps writer
(products/catalyst/bootstrap/api/internal/handler/sme_tenant_gitops.go,
function `WriteTenantOverlay`) commits a 9-file Kustomize overlay per
tenant to:

  clusters/<sovereign-fqdn>/sme-tenants/<sme_tenant_id>/

…on every successful POST /api/v1/sme/tenants. The overlay carries:

  - namespace.yaml          → `sme-<tenant-id>` Namespace
  - vcluster.yaml           → vCluster CR for the tenant control plane
  - bp-keycloak.yaml        → fresh realm + clients
  - bp-cnpg.yaml            → tenant Postgres
  - bp-wordpress-tenant.yaml
  - bp-openclaw.yaml
  - bp-stalwart-tenant.yaml
  - certificate.yaml        → BYO-mode TLS (skipped for free-subdomain)
  - kustomization.yaml      → the kustomize index

WITHOUT a Flux Kustomization watching this path, the orchestrator's
state machine optimistically advances through every step (vcluster →
bp_charts → dns → certs → keycloak_clients → registry) and reports
state=done — but no K8s resources materialise because nothing on the
Sovereign cluster is reconciling the path the orchestrator wrote into.
Documented live failure: otech103, 2026-05-04 (issue #882).

CONTRACT
--------
This template renders ONE Flux Kustomization per Sovereign that sweeps
the whole `sme-tenants` directory tree. Every per-tenant overlay
beneath it is reconciled as a sub-Kustomization via the kustomize
index file the orchestrator writes alongside the manifests, so adding
a new tenant is a pure git-commit operation — no chart upgrade needed.

  sourceRef: flux-system/openova   (the same GitRepository the cluster
                                    bootstraps from; cutover Step 5
                                    flips its `.spec.url` to the local
                                    in-cluster Gitea at
                                    http://gitea-http.gitea.svc.cluster.local:3000/openova/openova,
                                    which is precisely where
                                    sme_tenant_gitops.go pushes via
                                    CATALYST_GITOPS_REPO_URL)
  path:      ./clusters/<sov-fqdn>/sme-tenants
  interval:  1m  (matches the orchestrator's "Flux on the OTECH
                  cluster reconciles within ~1 min" SLA documented at
                  the top of sme_tenant_gitops.go)
  prune:     true  (a DELETE /api/v1/sme/tenants/<id> removes the
                    overlay directory; we want Flux to GC the tenant
                    resources accordingly)
  wait:      false (tenant overlays each install ~5 bp-* HelmReleases
                    independently; per-tenant readiness is owned by the
                    SME-tenant orchestrator's own watcher loop, not by
                    this top-level Kustomization. Avoids a stuck tenant
                    blocking every other tenant's reconcile)

GATING
------
Rendered ONLY when `.Values.ingress.marketplace.enabled=true` — same
flag the rest of the SME bundle (configmap.yaml, marketplace.yaml,
ferretdb.yaml, sme-secrets.yaml, …) is gated on. Non-marketplace
Sovereigns don't run the SME tenant pipeline so they don't need this
Kustomization.

Per Inviolable Principle #4 (never hardcode):
  - Sovereign FQDN comes from .Values.global.sovereignFQDN
    (populated from $${SOVEREIGN_FQDN} envsubst by the bootstrap-kit
    slot 13 overlay)
  - GitRepository name + namespace are operator-overridable via
    .Values.smeTenants.kustomization.sourceRef.{name,namespace}
  - All cadence/timeout knobs (interval, retryInterval, timeout) are
    operator-overridable via .Values.smeTenants.kustomization.*

Per Inviolable Principle #3, the chart templates the resource and
Flux owns the apply — we do NOT shell out to `kubectl apply`.

References:
  - Issue #882
  - sme_tenant_gitops.go (WriteTenantOverlay write target)
  - clusters/_template/bootstrap-kit/13-bp-catalyst-platform.yaml (slot pin)
  - clusters/_template/bootstrap-kit/03-flux.yaml (Kustomization shape)
*/}}
{{- if and .Values.ingress .Values.ingress.marketplace .Values.ingress.marketplace.enabled -}}
{{- $sovFQDN := .Values.global.sovereignFQDN -}}
{{- if $sovFQDN -}}
{{- $kt := (.Values.smeTenants).kustomization | default dict -}}
{{- $sourceRef := ($kt.sourceRef | default dict) -}}
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: {{ $kt.name | default "sme-tenants" | quote }}
  namespace: {{ $kt.namespace | default "flux-system" | quote }}
  labels:
    catalyst.openova.io/blueprint: bp-catalyst-platform
    catalyst.openova.io/component: sme-tenants-reconciler
    app.kubernetes.io/part-of: sme
spec:
  interval: {{ $kt.interval | default "1m" | quote }}
  retryInterval: {{ $kt.retryInterval | default "1m" | quote }}
  timeout: {{ $kt.timeout | default "5m" | quote }}
  path: ./clusters/{{ $sovFQDN }}/sme-tenants
  prune: {{ $kt.prune | default true }}
  # wait: false — each tenant overlay's bp-* HelmReleases install
  # asynchronously and have their own readiness watcher in the SME
  # tenant orchestrator. Blocking this Kustomization on every tenant's
  # full readiness would let one stuck tenant gate every other tenant.
  wait: {{ $kt.wait | default false }}
  sourceRef:
    kind: GitRepository
    name: {{ $sourceRef.name | default "openova" | quote }}
    namespace: {{ $sourceRef.namespace | default "flux-system" | quote }}
{{- end }}
{{- end }}
